-
Notifications
You must be signed in to change notification settings - Fork 4.1k
/
secrets_move.go
128 lines (100 loc) · 3.7 KB
/
secrets_move.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
package command
import (
"fmt"
"strings"
"time"
"github.com/mitchellh/cli"
"github.com/posener/complete"
)
var (
_ cli.Command = (*SecretsMoveCommand)(nil)
_ cli.CommandAutocomplete = (*SecretsMoveCommand)(nil)
)
const (
MountMigrationStatusSuccess = "success"
MountMigrationStatusFailure = "failure"
)
type SecretsMoveCommand struct {
*BaseCommand
}
func (c *SecretsMoveCommand) Synopsis() string {
return "Move a secrets engine to a new path"
}
func (c *SecretsMoveCommand) Help() string {
helpText := `
Usage: vault secrets move [options] SOURCE DESTINATION
Moves an existing secrets engine to a new path. Any leases from the old
secrets engine are revoked, but all configuration associated with the engine
is preserved. It initiates the migration and intermittently polls its status,
exiting if a final state is reached.
This command works within or across namespaces, both source and destination paths
can be prefixed with a namespace heirarchy relative to the current namespace.
WARNING! Moving a secrets engine will revoke any leases from the
old engine.
Move the secrets engine at secret/ to generic/:
$ vault secrets move secret/ generic/
Move the secrets engine at ns1/secret/ across namespaces to ns2/generic/,
where ns1 and ns2 are child namespaces of the current namespace:
$ vault secrets move ns1/secret/ ns2/generic/
` + c.Flags().Help()
return strings.TrimSpace(helpText)
}
func (c *SecretsMoveCommand) Flags() *FlagSets {
return c.flagSet(FlagSetHTTP)
}
func (c *SecretsMoveCommand) AutocompleteArgs() complete.Predictor {
return c.PredictVaultMounts()
}
func (c *SecretsMoveCommand) AutocompleteFlags() complete.Flags {
return c.Flags().Completions()
}
func (c *SecretsMoveCommand) Run(args []string) int {
f := c.Flags()
if err := f.Parse(args); err != nil {
c.UI.Error(err.Error())
return 1
}
args = f.Args()
switch {
case len(args) < 2:
c.UI.Error(fmt.Sprintf("Not enough arguments (expected 2, got %d)", len(args)))
return 1
case len(args) > 2:
c.UI.Error(fmt.Sprintf("Too many arguments (expected 2, got %d)", len(args)))
return 1
}
// Grab the source and destination
source := ensureTrailingSlash(args[0])
destination := ensureTrailingSlash(args[1])
client, err := c.Client()
if err != nil {
c.UI.Error(err.Error())
return 2
}
remountResp, err := client.Sys().StartRemount(source, destination)
if err != nil {
c.UI.Error(fmt.Sprintf("Error moving secrets engine %s to %s: %s", source, destination, err))
return 2
}
c.UI.Output(fmt.Sprintf("Started moving secrets engine %s to %s, with migration ID %s", source, destination, remountResp.MigrationID))
// Poll the status endpoint with the returned migration ID
// Exit if a terminal status is reached, else wait and retry
for {
remountStatusResp, err := client.Sys().RemountStatus(remountResp.MigrationID)
if err != nil {
c.UI.Error(fmt.Sprintf("Error checking migration status of secrets engine %s to %s: %s", source, destination, err))
return 2
}
if remountStatusResp.MigrationInfo.MigrationStatus == MountMigrationStatusSuccess {
c.UI.Output(fmt.Sprintf("Success! Finished moving secrets engine %s to %s, with migration ID %s", source, destination, remountResp.MigrationID))
return 0
}
if remountStatusResp.MigrationInfo.MigrationStatus == MountMigrationStatusFailure {
c.UI.Error(fmt.Sprintf("Failure! Error encountered moving secrets engine %s to %s, with migration ID %s", source, destination, remountResp.MigrationID))
return 0
}
c.UI.Output(fmt.Sprintf("Waiting for terminal status in migration of secrets engine %s to %s, with migration ID %s", source, destination, remountResp.MigrationID))
time.Sleep(10 * time.Second)
}
return 0
}